ERUNT 1.1j

from Lars Hederer

What is ERUNT?

The Emergency Recovery Utility NT, is a utility that can be used to backup and restore the Windows Registry.

About (from Lars Hederer)

With the invention of Windows 95 Microsoft made the wise decision toorganize all computer- and application-specific data which was spreadover countless INI files before in a centralized Windows database,called the system "registry". The registry is one of the mostimportant parts in every Windows system ... Read more

Overview

ERUNT 1.1j is a program developed by Lars Hederer. Upon installation and setup, it defines an auto-start registry entry which makes this program run on each Windows boot for all user logins. A scheduled task is added to Windows Task Scheduler in order to launch the program at various scheduled times (the schedule varies depending on the version). The software is designed to connect to the Internet and adds a Windows Firewall exception in order to do so without being interfered with. The main program executable is ERUNT.EXE. The software installer includes 21 files and is usually about 653.52 KB (669,209 bytes). In comparison to the total number of users, most PCs are running the OS Windows 7 (SP1) as well as Windows XP. While about 58% of users of ERUNT come from the United States, it is also popular in Germany and France.

Program details

URL: www.larshederer.homepage.t-online.de/erunt

Help link: www.larshederer.homepage.t-online.de/erunt

Installation folder: C:\Program Files\ERUNT\

Uninstaller: "C:\Program Files\ERUNT\unins000.exe"

Estimated size: 653.52 KB

Files installed by ERUNT 1.1j

Program executable:

ERUNT.EXE

Path:

C:\Program Files\ERUNT\ERUNT.EXE

MD5:

2e0323a94915faab10a25f3babf82584

Additional files:

erunt-setup.exe - ERUNT Setup

unins000.exe - Inno Setup (Uninstaller)

autoback.exe

erunt.exe

ntregopt.exe

Uninstal.exe

Behaviors exhibited

3 Scheduled Tasks

AUTOBACK.EXE is scheduled as a task named 'ERUNT automatic Backup' (runs on boot).

ERUNT.EXE is scheduled as a task with the class '{44FA00FB-602C-44D5-BBA3-DF2800F50970}' (runs on registration).

NTREGOPT.EXE is scheduled as a task with the class '{F4DA7E96-7E9D-45B2-827D-0E186416D40D}' (runs on registration).

2 Scheduled Tasks (Boot/Login)

AUTOBACK.EXE is automatically launched at startup through a scheduled task named ERUNT automatic Backup.

ERUNT.EXE is automatically launched at startup through a scheduled task named ERUNT.

Startup File (User Run)

ERUNT.EXE is loaded in the current user (HKCU) registry as an auto-starting executable named 'ERUNT' and executes as C:\Erunt\ERUNT\ERUNT.EXE.

2 Startup Files (All Users Run)

AUTOBACK.EXE is loaded in the all users (HKLM) registry as a startup file name 'AUTOBACK' which loads as "C:\Program Files\ERUNT\AUTOBACK.EXE" C:\Backups_Win7/ERDNT\AutoBackup\#Date# /noconfirmdelete /noprogresswindow.

ERUNT.EXE is loaded in the all users (HKLM) registry as a startup file name 'ERUNT.EXE' which loads as "C:\Program Files\ERUNT\ERUNT.EXE".

3 Windows Firewall Allowed Programs

AUTOBACK.EXE is added as a firewall exception for 'C:\Program Files\ERUNT\AUTOBACK.EXE'.

unins000.exe is added as a firewall exception for 'C:\Program Files\Lavalys\EVEREST Home Edition\unins000.exe'.

NTREGOPT.EXE is added as a firewall exception for 'C:\Program Files\NT Registry Optimizer\NTREGOPT.EXE'.